The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.
Extended Description
For example, if a server handles multiple simultaneous connections, and an assert() occurs in one single connection that causes all other connections to be dropped, this is a reachable assertion that leads to a denial of service.
Time of Introduction
Implementation
Common Consequences
Scope
Effect
Availability
Technical Impact: DoS: crash / exit /
restart
Demonstrative Examples
Example 1
In the excerpt below, an AssertionError (an unchecked exception) is
thrown if the user hasn't entered an email address in an HTML
form.
Chain: security monitoring product has an
off-by-one error that leads to unexpected length values, triggering an
assertion.
Potential Mitigations
Make sensitive open/close operation non reachable by directly
user-controlled data (e.g. open/close resources)
Perform input validation on user data.
Other Notes
While assertion is good for catching logic errors and reducing the chances
of reaching more serious vulnerability conditions, it can still lead to a
denial of service if the relevant code can be triggered by an attacker, and
if the scope of the assert() extends beyond the attacker's own
session.
Weakness Ordinalities
Ordinality
Description
Resultant
(where
the weakness is typically related to the presence of some other
weaknesses)
Description
